Code detection method, device and equipment based on large model

Abstract

The embodiment of the invention discloses a code detection method, device and equipment based on a large model. In the embodiment of the invention, a unique code of a first target node is acquired; obtaining at least one path in a vector storage database according to the unique code of the first target node; a plurality of second target nodes included in the at least one path are determined, and the second target nodes are all other nodes except the first target node in the path; determining all codes on a calling link reaching the first target node according to the at least one path and the plurality of second target nodes; and inputting all the codes on the calling link into a large model, and carrying out code detection on all the codes on the calling link. Through the method, the business logic vulnerabilities can be efficiently and accurately identified.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a method, apparatus, and device for code detection based on a large model. Background Technology

[0002] In the field of cybersecurity, attack methods against code have expanded from technical vulnerabilities to include business logic vulnerabilities. Technical vulnerabilities include Server-Side Request Forgery (SSRF) and Structured Query Language Injection (SQL Injection), while business logic vulnerabilities include bypassing login verification, cookie brute-force attacks, payment logic bypassing, and invoicing logic bypassing.

[0003] In existing technologies, Static Application Security Testing (SAST) is used to identify technical vulnerabilities. However, since business logic vulnerabilities do not have unified characteristics and there is no unified verification, it is difficult to establish a large-scale investigation. Therefore, SAST cannot be used to identify the aforementioned business logic vulnerabilities.

[0004] In conclusion, how to efficiently and accurately identify business logic vulnerabilities is a problem that needs to be solved. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a method, apparatus and device for code detection based on a large model, which can efficiently and accurately identify business logic vulnerabilities.

[0006] In a first aspect, embodiments of the present invention provide a method for code detection based on a large model. The method includes: obtaining a unique code of a first target node; obtaining at least one path in a vector storage database based on the unique code of the first target node; determining a plurality of second target nodes included in the at least one path, wherein the second target nodes are all other nodes in the path except the first target node; determining all code on the call chain leading to the first target node based on the at least one path and the plurality of second target nodes; inputting all code on the call chain into a large model, and performing code detection on all code on the call chain.

[0007] Optionally, inputting all the code on the call chain into the large model and performing code detection on all the code on the call chain specifically includes: in response to the fact that all the code on the call chain includes nodes marked as polluted; or, the call chain includes edges marked as polluted propagation, determining that there is a vulnerability in all the code on the call chain.

[0008] Optionally, the step of inputting all the code on the call chain into the large model and performing code detection on all the code on the call chain specifically includes: in response to the fact that all the code on the call chain does not include nodes marked as polluted; and the call chain does not include edges marked as polluted propagation, determining that there are no vulnerabilities in all the code on the call chain.

[0009] Optionally, the method further includes: obtaining user problem information, wherein the user problem information includes function feature information; and determining the first target node based on the function feature information.

[0010] Optionally, obtaining at least one path in the vector storage database based on the unique code of the first target node specifically includes: serializing the unique code of the first target node to generate target metadata; indexing the target metadata in the vector storage database to obtain at least one path metadata; and obtaining the at least one path based on the at least one path metadata.

[0011] Optionally, the process of generating the vector storage database includes: obtaining complete project code; identifying multiple programming language files in the complete project code; inputting each programming language file into a large model, outputting multiple nodes, multiple edges, and a control flow graph (CFG), wherein the nodes are code segments of functions; inputting the multiple nodes, multiple edges, and the CFG into the large model, outputting edges for pollution propagation and polluted nodes; saving the multiple nodes, multiple edges, and multiple paths into the vector storage database, and marking the edges for pollution propagation and polluted nodes, wherein the multiple paths are possible paths from entry nodes to exit nodes among the multiple nodes.

[0012] Optionally, saving the plurality of nodes, the plurality of edges, and the plurality of paths to the vector storage database specifically includes: determining the unique codes of the plurality of nodes, the plurality of edges, and the plurality of paths; for each path, determining the unique code sequence of the plurality of nodes included in each path, performing serialization conversion on the unique code sequence to generate path metadata; and saving the unique codes of the plurality of nodes, the plurality of edges, the plurality of paths, and the plurality of path metadata to the vector storage database.

[0013] Optionally, the method further includes: obtaining the vector of each path among the multiple paths, and saving the vector of each path to the vector storage database.

[0014] Secondly, embodiments of the present invention provide a code detection apparatus based on a large model, the apparatus comprising: an acquisition unit, configured to acquire a unique code of a first target node; the acquisition unit is further configured to: acquire at least one path in a vector storage database based on the unique code of the first target node; a determination unit, configured to determine a plurality of second target nodes included in the at least one path, wherein the second target nodes are all other nodes in the path except the first target node; the determination unit is further configured to: determine all code on the call chain leading to the first target node based on the at least one path and the plurality of second target nodes; and a detection unit, configured to input all code on the call chain into a large model and perform code detection on all code on the call chain.

[0015] Optionally, the detection unit is specifically used to: determine that a vulnerability exists in all the code on the call chain in response to the fact that all the code on the call chain includes nodes marked as polluted; or, the call chain includes edges marked as pollutant propagation.

[0016] Optionally, the detection unit is specifically configured to: in response to the fact that the entire code on the call chain does not include nodes marked as polluted, and the call chain does not include edges marked as pollutant propagation, determine that there are no vulnerabilities in the entire code on the call chain.

[0017] Optionally, the acquisition unit is further configured to: acquire user problem information, wherein the user problem information includes function feature information; the determination unit is further configured to: determine the first target node based on the function feature information.

[0018] Optionally, the acquisition unit is specifically used to: serialize the unique code of the first target node to generate target metadata; the acquisition unit is also used to: perform metadata indexing in the vector storage database according to the target metadata to obtain at least one path metadata; and obtain the at least one path according to the at least one path metadata.

[0019] Optionally, during the generation of the vector storage database, the apparatus further includes:

[0020] A generation unit is used to obtain complete project code; identify multiple programming language files in the complete project code; input each programming language file into a large model, and output multiple nodes, multiple edges, and a control flow graph (CFG), wherein the nodes are code segments of functions; input the multiple nodes, multiple edges, and the CFG into the large model, and output contamination propagation edges and contaminated nodes; save the multiple nodes, multiple edges, and multiple paths into the vector storage database, and mark the contamination propagation edges and contaminated nodes, wherein the multiple paths are possible paths from entry nodes to exit nodes among the multiple nodes.

[0021] Optionally, the generation unit is specifically used to: determine the unique codes of the plurality of nodes, the plurality of edges, and the plurality of paths; for each path, determine the unique code sequence of the plurality of nodes included in each path, perform serialization conversion on the unique code sequence to generate path metadata; and save the unique codes of the plurality of nodes, the plurality of edges, the plurality of paths, and the plurality of path metadata into the vector storage database.

[0022] Optionally, the generation unit is further configured to: obtain the vector of each path among the multiple paths, and save the vector of each path to the vector storage database.

[0023] Thirdly, embodiments of the present invention provide an electronic device, including a memory and a processor, wherein the memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method as described in the first aspect or any one of the possible methods of the first aspect.

[0024] Fourthly, embodiments of the present invention provide a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the method as described in the first aspect or any one of the possibilities of the first aspect.

[0025] In this embodiment of the invention, the unique code of a first target node is obtained; at least one path is obtained from a vector storage database based on the unique code of the first target node; multiple second target nodes are determined within the at least one path, wherein the second target nodes are all other nodes in the path besides the first target node; all code on the call chain leading to the first target node is determined based on the at least one path and the multiple second target nodes; and all code on the call chain is input into a large model for code detection. Through this method, business logic vulnerabilities can be identified efficiently and accurately. Attached Figure Description

[0026] The above and other objects, features and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which:

[0027] Figure 1 This is a flowchart of a method for generating a vector storage database according to an embodiment of the present invention;

[0028] Figure 2 This is a schematic diagram of a control flow graph in an embodiment of the present invention;

[0029] Figure 3 This is another control flow graph schematic diagram in an embodiment of the present invention;

[0030] Figure 4 This is a flowchart of a code detection method based on a large model in an embodiment of the present invention;

[0031] Figure 5 This is a flowchart of another code detection method based on a large model in an embodiment of the present invention;

[0032] Figure 6 This is a schematic diagram of a code detection device based on a large model in an embodiment of the present invention;

[0033] Figure 7 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0034] The present application is described below based on embodiments, but it is not limited to these embodiments. In the detailed description of the present application below, certain specific details are described in detail. Those skilled in the art can fully understand the present application without these details. To avoid obscuring the substance of the present application, well-known methods, processes, flows, elements, and circuits are not described in detail.

[0035] Furthermore, those skilled in the art should understand that the accompanying drawings provided herein are for illustrative purposes only and are not necessarily drawn to scale.

[0036] Unless the context explicitly requires it, words such as "including" or "contains" throughout the application should be interpreted as including rather than exclusive or exhaustive; that is, meaning "including but not limited to".

[0037] In the description of this application, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0038] In existing technologies, Static Application Security Testing (SAST) is used to identify technical vulnerabilities such as Server-Side Request Forgery (SSRF) and Structured Query Language (SQuery Language) injection. However, for business logic vulnerabilities such as login verification bypass, cookie brute-force attacks, payment logic bypass, and invoicing logic bypass, the lack of unified characteristics and verification methods makes it difficult to establish a large-scale investigation. Therefore, SAST cannot be used to identify these business logic vulnerabilities, and identification mainly relies on manual methods. To avoid reliance on manual methods, an open-source large model is used to test the code. This open-source large model generates an Abstract Syntax Tree (AST) based on existing SAST products. The AST (Simplified Chinese Abstract Tree) structure, as described above, involves parsing the following steps: first, identifying all code along the call chain from the entry node to the end node; then, providing all code along this call chain to the larger model; finally, the larger model determines whether any code along the call chain contains vulnerabilities. However, due to white-box limitations, code omissions occur when the propagation chain is broken, leading to the inability to find subsequent call chain code, such as in cases of reflection or polymorphism. Furthermore, the AST relies on feature identification of the entry node, resulting in significant manual costs for framework compatibility. Therefore, how to efficiently and accurately identify business logic vulnerabilities is a problem that needs to be solved.

[0039] In this embodiment of the invention, the Large Language Model (LLM) can also be called a large language model or a large-scale language model, etc. The large language model is a deep learning model based on a transformer architecture that can process and generate natural language text. It is usually trained on a large amount of text data and has the ability to understand and generate language. It is widely used in dialogue systems, text generation and other natural language processing tasks.

[0040] In this embodiment of the invention, to solve the above problems, it is first necessary to generate a vector storage database, and then perform code detection based on the vector storage database. The specific process of generating the vector storage database is as follows: Figure 1 As shown, the method includes:

[0041] Step S101: Obtain the complete project code.

[0042] Specifically, the complete project code includes at least one programming language such as Hypertext Preprocessor (PHP), Python, Go, Java, and JavaScript.

[0043] Step S102: Identify the multiple programming language files in the complete project code.

[0044] Specifically, the complete project code is filtered according to programming languages ​​such as PHP, Python, Go, Java, and JavaScript to determine multiple programming language files. For example, all PHP code in the complete project code is categorized into the same programming language file; all Python code in the complete project code is categorized into the same programming language file; all Go code in the complete project code is categorized into the same programming language file; all Java code in the complete project code is categorized into the same programming language file; and all JavaScript code in the complete project code is categorized into the same programming language file.

[0045] In this embodiment of the invention, the complete project code may also include other programming languages, generating other programming language files, depending on the actual situation. This invention does not limit the specific programming language used.

[0046] Step S103: Input each of the programming language files into the large model and output multiple nodes, multiple edges, and a control flow graph (CFG).

[0047] Specifically, the large model is used to analyze the programming language file. For example, the programming language file corresponding to PHP is input into the large model, and multiple nodes, multiple edges, and the CFG are output. Nodes are code segments of functions, also known as methods; edges represent relationships between methods. The CFG (Control Flow Graph) is a graph representation used to describe all possible execution paths in a program. Nodes represent basic blocks, i.e., code segments, which are implemented as functions; edges represent control flow, i.e., the order of program execution. The CFG includes the classes, parent classes, methods, and other methods called by the programming language file. Related functions belong to the same class, and classes can inherit methods from their parent classes. A method calling another method indicates that node A calls node B; node A is called the caller. Nodes are recorded according to different node types, including entry and exit points, which is only an example here.

[0048] Step S104: Input the multiple nodes, multiple edges, and the CFG into the large model, and output the edges of pollution propagation and the polluted nodes.

[0049] Specifically, the large model can perform semantic analysis on the multiple nodes, multiple edges, and the CFG to determine the pollution source entry node (source), pollution exit node (sink), and the edges for pollution propagation from the pollution source entry node to the pollution exit node. Here, the Source is the entry point in the program that receives untrusted external data, which may come from user input, file reading, network requests, environmental variables, etc. The Source is the starting point of tainted data; if it is not sufficiently validated or filtered, it may lead to security vulnerabilities. The Sink is the endpoint in taint analysis, representing the point in the program that receives tainted data and may perform dangerous operations; if tainted data reaches the Sink directly without being rendered harmless, it may lead to security vulnerabilities.

[0050] In one possible implementation, the CFG generated by the complete project code is as follows: Figure 2 As shown, it includes multiple nodes and multiple edges, for example, the... Figure 2 The CFG includes nodes 1 to 22, and multiple edges between the nodes; based on the multiple nodes, multiple edges, and the CFG, the contaminated nodes and the edges from which the contamination propagates are determined, specifically as follows: Figure 3 As shown, specifically, the contaminated nodes are nodes 9, 10, 12, 7, 16, 17, 18, 19, 20, and 22; the edges from which the contamination propagates are the edges from node 9 to node 10, node 10 to node 12, node 7 to node 16, node 7 to node 17, node 18 to node 17, node 18 to node 19, node 20 to node 22, and node 22 to node 17; this is only an illustrative example, and the specific details should be determined according to the actual situation.

[0051] In this embodiment of the invention, the process from steps S101 to S104 can also be called source code function call graph analysis. Assuming that a function call graph is constructed according to the project-level application, it can be seen from the corresponding function call graph that there are polymorphic methods, i.e., nodes, in the handle of the basehandler, and the edges of pollution propagation (also called pollution propagation paths) are marked in the call graph. Among them, one path can lead to a dangerous function (sink) that causes server request forgery (SSRF). The BaseHandler is usually a basic request processing class, and the handle method is its core method, responsible for processing the incoming request and generating a response. This is only an illustrative example, and the specific method should be determined according to the actual situation.

[0052] Step S105: Save the multiple nodes, multiple edges, and multiple paths to the vector storage database, and mark the edges and nodes that are contaminated.

[0053] The multiple paths refer to the possible paths from the entry node to the exit node among the multiple nodes.

[0054] Specifically, saving the multiple nodes, multiple edges, and multiple paths to the vector storage database includes: determining the unique codes (IDs) of the multiple nodes, multiple edges, and multiple paths; for each path, determining the unique code sequence of the multiple nodes included in each path, serializing the unique code sequence to generate path metadata; and saving the unique codes of the multiple nodes, multiple edges, and multiple paths, as well as the path metadata, to the vector storage database.

[0055] In one possible implementation, assuming any path includes four nodes, executed in the order of node a, node b, node c, and node d, where the ID of node a is 0101, the ID of node b is 0111, the ID of node c is 1101, and the ID of node d is 1001, then the ID sequence of any path is 0101 0111 1101 1001. This ID sequence 0101 0111 1101 1001 can be serialized into a string or array, serving as the path metadata for any path. The IDs of the nodes and edges are saved to the vector storage database, along with the node type, name, and other relevant information. Simultaneously, the IDs and metadata of multiple paths are also saved to the vector storage database, and the edges and nodes involved in the pollution propagation are marked in the vector storage database. The IDs of each node are merely illustrative and are not limited in this embodiment.

[0056] In this embodiment of the invention, the method further includes: obtaining the vector of each path among multiple paths, and saving the vector of each path to the vector storage database.

[0057] In this embodiment of the invention, a code detection method based on a large model is proposed, specifically as follows: Figure 4 As shown, the method includes:

[0058] Step S401: Obtain the unique code of the first target node.

[0059] Specifically, the first target node is the node where the code segment that the user inputs may contain high-risk functions is located, and the ID of the first target node is determined.

[0060] Step S402: Obtain at least one path from the vector storage database based on the unique code of the first target node.

[0061] Specifically, the unique code of the first target node is serialized to generate target metadata; the target metadata is indexed in the vector storage database to obtain at least one path metadata; and the at least one path is obtained based on the at least one path metadata.

[0062] For example, assuming the ID of the first target node is 0011, the 0011 is serialized and converted into target metadata consisting of a string or an array. Metadata indexing is then performed based on the target metadata, specifically using Elasticsearch, a distributed search and analysis engine designed for handling massive amounts of data (this is just an example). The path metadata in the vector storage database is then indexed based on the target metadata to determine the path metadata containing the target metadata, with each path metadata corresponding to a path. For instance, if the ID of the first target node is converted to the character 'x', the path metadata in the vector storage database is indexed, and the path metadata containing 'x' is queried. This is just an example; the specific character, string, or array converted from the ID of the first target node is determined according to the actual situation, and this embodiment of the invention does not limit it.

[0063] In one possible implementation, assuming that five path metadata are indexed based on the target metadata, five paths are determined.

[0064] Step S403: Determine the multiple second target nodes included in the at least one path.

[0065] The second target node is all the other nodes in the path except for the first target node.

[0066] In one possible implementation, each path consists of multiple nodes, including at least one other node besides the first target node, namely the second target node.

[0067] Step S404: Determine all the code on the call chain leading to the first target node based on the at least one path and the plurality of second target nodes.

[0068] Specifically, multiple second target nodes in the at least one path are reorganized to generate a target path with the first target node as the exit node, and all nodes on the complete call chain of the target path and their corresponding code are determined.

[0069] Step S405: Input all the code on the call chain into the large model and perform code detection on all the code on the call chain.

[0070] In one possible implementation, inputting all the code in the call chain into a large model and performing code inspection on all the code in the call chain includes two cases, as follows:

[0071] Scenario 1: In response to the fact that all code on the call chain includes nodes marked as polluted; or, the call chain includes edges marked as pollutant propagation, it is determined that a vulnerability exists in all code on the call chain.

[0072] Scenario 2: In response to the fact that the entire code on the call chain does not include nodes marked as polluted, and the call chain does not include edges marked as pollutant propagation, it is determined that there is no vulnerability in the entire code on the call chain.

[0073] In this embodiment of the invention, after step S101, other steps are included, specifically as follows: Figure 5 The above includes the following:

[0074] Step S406: Obtain user problem information.

[0075] The user transfer issue information includes function feature information;

[0076] Step S407: Determine the first target node based on the function feature information.

[0077] Through the above embodiments, the semantic understanding of the large model ensures the completeness of the CFG generated from the project code. Furthermore, after parsing the project code once using the large model, if the project code remains unchanged, multiple parsings are unnecessary; the data stored in the vector storage database is directly indexed. For newly added vulnerability types, the results can be directly searched and analyzed in the vector storage database, improving efficiency during large-scale investigations of new vulnerability types and supporting the search for logic-based vulnerabilities. Since the large model can identify code semantics and find all code in the call chain, it is not limited by white-box bottlenecks.

[0078] In this embodiment of the invention, a device for code detection based on a large model is provided, such as... Figure 6 As shown, it specifically includes: an acquisition unit 601, a determination unit 602, and a detection unit 603;

[0079] The acquisition unit 601 is used to acquire the unique code of the first target node; the acquisition unit 601 is also used to: acquire at least one path in the vector storage database based on the unique code of the first target node; the determination unit 602 is used to determine a plurality of second target nodes included in the at least one path, wherein the second target nodes are all other nodes in the path except the first target node; the determination unit 602 is also used to determine all the code on the call chain leading to the first target node based on the at least one path and the plurality of second target nodes; the detection unit 603 is used to input all the code on the call chain into the large model and perform code detection on all the code on the call chain.

[0080] Furthermore, the detection unit is specifically used to: determine that a vulnerability exists in all the code on the call chain in response to the fact that all the code on the call chain includes nodes marked as polluted; or, the call chain includes edges marked as pollutant propagation.

[0081] Furthermore, the detection unit is specifically configured to: in response to the fact that the entire code on the call chain does not include nodes marked as polluted; and the call chain does not include edges marked as pollutant propagation, determine that there are no vulnerabilities in the entire code on the call chain.

[0082] Furthermore, the acquisition unit is also configured to: acquire user problem information, wherein the user problem information includes function feature information; the determination unit is also configured to: determine the first target node based on the function feature information.

[0083] Furthermore, the acquisition unit is specifically used to: serialize the unique code of the first target node to generate target metadata; the acquisition unit is also used to: index the metadata in the vector storage database according to the target metadata to obtain at least one path metadata; and obtain the at least one path according to the at least one path metadata.

[0084] Furthermore, in the process of generating the vector storage database, the device further includes: a generation unit, used to acquire complete project code; determine multiple programming language files in the complete project code; input each programming language file into a large model, and output multiple nodes, multiple edges, and a control flow graph (CFG), wherein the nodes are code segments of functions; input the multiple nodes, multiple edges, and the CFG into the large model, and output contamination propagation edges and contaminated nodes; save the multiple nodes, multiple edges, and multiple paths into the vector storage database, and mark the contamination propagation edges and contaminated nodes, wherein the multiple paths are possible paths from entry nodes to exit nodes among the multiple nodes.

[0085] Further, the generation unit is specifically used to: determine the unique codes of the plurality of nodes, the plurality of edges, and the plurality of paths; for each path, determine the unique code sequence of the plurality of nodes included in each path, perform serialization conversion on the unique code sequence to generate path metadata; and save the unique codes of the plurality of nodes, the plurality of edges, the plurality of paths, and the plurality of path metadata into the vector storage database.

[0086] Furthermore, the generation unit is specifically used to: obtain the vector of each path in the multiple paths, and save the vector of each path to the vector storage database.

[0087] Figure 7 This is a schematic diagram of the structure of the electronic device described in an embodiment of the present invention. Figure 7 As shown, it includes a general computer hardware architecture, which includes at least a processor 701 and a memory 702. The processor 701 and the memory 702 are connected via a bus 703. The memory 702 is adapted to store instructions or programs executable by the processor 701. The processor 701 can be a standalone microprocessor or a collection of one or more microprocessors. Thus, the processor 701 executes the instructions stored in the memory 702 to perform the method flow of the embodiments of the present invention as described above, thereby realizing data processing and control of other devices. The bus 703 connects the above-mentioned components together, and also connects the above-mentioned components to a display controller 704, a display device, and an input / output (I / O) device 705. The input / output (I / O) device 705 can be a mouse, keyboard, modem, network interface, touch input device, motion-sensing input device, printer, and other devices known in the art. Typically, the input / output device 705 is connected to the system via an input / output (I / O) controller 706.

[0088] The instructions stored in memory 702 are executed by at least one processor 701 to achieve the following: obtaining the unique code of a first target node; obtaining at least one path in a vector storage database based on the unique code of the first target node; determining a plurality of second target nodes included in the at least one path, wherein the second target nodes are all other nodes in the path except the first target node; determining all the code on the call chain leading to the first target node based on the at least one path and the plurality of second target nodes; inputting all the code on the call chain into a large model, and performing code detection on all the code on the call chain.

[0089] Specifically, the electronic device includes: one or more processors 701 and a memory 702. Figure 7 Take a processor 701 as an example. The processor 701 and the memory 702 can be connected via a bus or other means. Figure 7 Taking a bus connection as an example, memory 702, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Processor 701 executes various functional applications and data processing of the device by running the non-volatile software programs, instructions, and modules stored in memory 702, thereby implementing the aforementioned method for determining code detection based on a large model.

[0090] Memory 702 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; the data storage area may store an option list, etc. Furthermore, memory 702 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, memory 702 may optionally include memory remotely located relative to processor 701, and these remote memories may be connected to external devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0091] One or more modules are stored in memory 702, and when executed by one or more processors 701, they perform the code detection method based on a large model in any of the above method embodiments.

[0092] As those skilled in the art will recognize, various aspects of the embodiments of the present invention can be implemented as a system, method, or computer program product. Therefore, various aspects of the embodiments of the present invention can take the form of a completely hardware implementation, a completely software implementation (including firmware, resident software, microcode, etc.), or an implementation combining software and hardware aspects, which may generally be referred to herein as a "circuit," "module," or "system." Furthermore, various aspects of the embodiments of the present invention can take the form of a computer program product implemented in one or more computer-readable media having computer-readable program code implemented thereon.

[0093] Any combination of one or more computer-readable media can be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, (but not limited to) an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination thereof. More specific examples (not an exhaustive list) of computer-readable storage media will include: an electrical connection having one or more wires, a portable computer floppy disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable optical disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the context of embodiments of the present invention, a computer-readable storage medium can be any tangible medium capable of containing or storing a program used by or in conjunction with an instruction execution system, device, or apparatus.

[0094] Computer-readable signal media may include propagated digital signals having computer-readable program code implemented therein, such as in baseband or as part of a carrier wave. Such propagated signals may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and can communicate, propagate, or transmit a program used by or in conjunction with an instruction execution system, device, or apparatus.

[0095] Program code implemented on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, fiber optic cable, RF, or any suitable combination thereof.

[0096] Computer program code for performing operations relating to various aspects of embodiments of the present invention can be written in any combination of one or more programming languages, including: object-oriented programming languages ​​such as Java, Smalltalk, C++, etc.; and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages. The program code can be executed as a standalone software package entirely on the user's computer, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet provided by an Internet service provider).

[0097] The flowchart illustrations and / or block diagrams of the methods, apparatus (systems), and computer program products according to embodiments of the present invention describe various aspects of the embodiments of the present invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions (executed via the processor of the computer or other programmable data processing apparatus) create means for implementing the functions / actions specified in the flowchart and / or block diagram blocks or blocks.

[0098] These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing apparatus or other means to operate in a particular manner, such that the instructions stored in the computer-readable medium produce an article of writing that includes instructions that implement the functions / actions specified in flowchart and / or block diagram blocks or blocks.

[0099] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus or other device to cause a series of operable steps to be performed on the computer, other programmable apparatus or other device to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide for implementing the functions / actions specified in flowchart and / or block diagram blocks or blocks.

[0100] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0101] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding access points are provided for users to choose to authorize or refuse processing. A user's refusal to process personal information beyond what is necessary for basic functions will not affect the user's use of basic functions.

Claims

1. A code detection method based on a large model, characterized in that, The method includes: Obtain the unique code of the first target node; At least one path is obtained from the vector storage database based on the unique code of the first target node; Determine a plurality of second target nodes included in the at least one path, wherein the second target nodes are all other nodes in the path except for the first target node; Based on the at least one path and the plurality of second target nodes, determine all the code on the call chain leading to the first target node; All the code in the call chain is input into the large model, and code detection is performed on all the code in the call chain.

2. The method according to claim 1, characterized in that, The step of inputting all the code in the call chain into the large model and performing code detection on all the code in the call chain specifically includes: In response to the fact that all code on the call chain includes nodes marked as polluted, or that the call chain includes edges marked as pollutant propagation, a vulnerability is determined to exist in all code on the call chain.

3. The method according to claim 1, characterized in that, The step of inputting all the code in the call chain into the large model and performing code detection on all the code in the call chain specifically includes: In response to the fact that the entire code on the call chain does not include nodes marked as polluted, and the call chain does not include edges marked as pollutant propagation, it is determined that there is no vulnerability in the entire code on the call chain.

4. The method according to claim 1, characterized in that, The method further includes: Obtain user problem information, wherein the user problem information includes function feature information; The first target node is determined based on the function feature information.

5. The method according to claim 1, characterized in that, The step of obtaining at least one path from the vector storage database based on the unique code of the first target node specifically includes: The unique code of the first target node is serialized to generate target metadata; Based on the target metadata, perform metadata indexing in the vector storage database to obtain at least one path metadata; The at least one path is obtained based on the at least one path metadata.

6. The method according to claim 1, characterized in that, The process of generating the vector storage database includes: Get the complete project code; Identify the multiple programming language files within the complete project code; Each of the programming language files is input into the large model, and multiple nodes, multiple edges, and a control flow graph (CFG) are output, wherein the nodes are code segments of functions; The multiple nodes, multiple edges, and the CFG are input into the large model, and the edges of pollution propagation and the polluted nodes are output. The multiple nodes, multiple edges, and multiple paths are saved to the vector storage database, and the edges and contaminated nodes that spread the pollution are marked. The multiple paths are possible paths from the entry node to the exit node among the multiple nodes.

7. The method according to claim 6, characterized in that, The step of saving the multiple nodes, multiple edges, and multiple paths to the vector storage database specifically includes: Determine the unique encoding of the plurality of nodes, the plurality of edges, and the plurality of paths; For each path, a unique encoding sequence of multiple nodes included in each path is determined, and the unique encoding sequence is serialized to generate path metadata; The unique codes of the multiple nodes, the multiple edges, the multiple paths, and the multiple path metadata are saved to the vector storage database.

8. The method according to claim 6, characterized in that, The method further includes: Obtain the vector of each path from the multiple paths, and save the vector of each path to the vector storage database.

9. A device for code detection based on a large model, characterized in that, The device includes: The acquisition unit is used to acquire the unique code of the first target node; The acquisition unit is further configured to: acquire at least one path in the vector storage database based on the unique code of the first target node; A determining unit is configured to determine a plurality of second target nodes included in the at least one path, wherein the second target nodes are all other nodes in the path except for the first target node; The determining unit is further configured to determine, based on the at least one path and the plurality of second target nodes, all the code on the call chain leading to the first target node; The detection unit is used to input all the code on the call chain into the large model and perform code detection on all the code on the call chain.

10. An electronic device comprising a memory and a processor, characterized in that, The memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1-8.

Images